TDE prevent unauthorized access to the data by restoring the files to another server, because it requires the original encryption certificate and master key.
If i applied a table level encryption using TDE to my database, and am accessing the database from my windows application, through proper authentication. Consider that an intruder is trying some injection technique, my question is that whether he receives the original data or the encrypted one? or can we use TDE as an anti-injection technique?
The query from my application may looks like:
Dim myQuery="Select * from myTable where some_id='" & txtUserId.Text & "'
so that they can inject sql by giving the text like sameValue' or 1=1 or ' will give the whole data. in this case whether he get the encrypted data or be the actual data
Note: i don't use such queries in my application, am using parameterized query and sp throughout my application. asking this for just clarification.
Best Answer
The attacker will get the data unencrypted.
The T in TDE stands for "transparent". The user will never see encrypted data. The database transparently decrypts it when it is read from disk and transparently encrypts it when writing to disk. If your application is insecure, TDE doesn't help you plug those application security holes. You need to fix those in the application (so use bind variables!)